Merge pull request #82 from tstromberg/xz_incident

Increasingly paranoid rules based on xz analysis

Author: tstromberg

rules/env/LD_DEBUG.yara

@@ -0,0 +1,8 @@
+rule env_LD_DEBUG : suspicious {
+  meta:
+    description = "Checks if dynamic linker debugging is enabled"
+  strings:
+	$val = "LD_DEBUG" fullword
+  condition:
+	all of them
+}

rules/env/LD_PROFILE.yara

@@ -0,0 +1,8 @@
+rule env_LD_PROFILE : suspicious {
+  meta:
+    description = "Checks if dynamic linker profiling is enabled"
+  strings:
+	$val = "LD_PROFILE" fullword
+  condition:
+	all of them
+}

rules/env/TERM.yara

@@ -1,4 +1,4 @@
-rule TERM : harmless {
+rule TERM {
   meta:
 	description = "Look up or override terminal settings"
   strings:

rules/ref/program/sshd.yara

@@ -8,6 +8,14 @@ rule sshd : notable {
     $ref
 }
 
+rule sshd_path_value : suspicious {
+  meta:
+	description = "Mentions the SSH daemon by path"
+  strings:
+	$ref = "/usr/bin/sshd" fullword
+  condition:
+    $ref
+}
 
 rule sshd_net : suspicious {
   meta:

rules/shell/byte_offsets.yara

@@ -0,0 +1,17 @@
+rule tail_byte_offsets : notable {
+  meta:
+	description = "uses the tail command with exotic offset values"
+  strings:
+	$val = /tail -c \+\d{3,8}/
+  condition:
+    any of them
+}
+
+rule head_byte_offsets : notable {
+  meta:
+	description = "uses the head command with exotic offset values"
+  strings:
+	$val = /head -c \+\d{3,8}/
+  condition:
+    any of them
+}

rules/shell/pipe_sh.yara

@@ -0,0 +1,11 @@
+rule pipe_to_shell : notable {
+  meta:
+  	description = "pipes to shell"
+  strings:
+    $val_sh = "| sh"
+    $val_bin_sh = "| /bin/sh"
+    $val_bash = "| bash"
+    $val_bin_bash = "| /bin/bash"
+  condition:
+	any of them
+}

rules/techniques/code_eval.yara

@@ -8,7 +8,6 @@ rule eval : suspicious {
 		$ref and not $empty
 }
 
-
 rule python_exec : suspicious {
 	meta:
 		description = "evaluate code dynamically using exec()"
@@ -18,3 +17,12 @@ rule python_exec : suspicious {
 	condition:
 		$ref and not $empty
 }
+
+rule shell_eval : suspicious {
+	meta:
+		description = "evaluate code dynamically using eval"	
+	strings:
+		$val = /eval \$\w{0,64}/ fullword
+	condition:
+		$val
+}